Wanene zai iya ganin zirga-zirgar ka a kan sabar VPN da aka yi hayar?
Yin hayar sabar VPN yana motsa amana zuwa ga mai ba da hosting. Bi hanyar daga abokin ciniki zuwa fitowa ka ga abin da kowane mai lura zai iya sani da abin da ba zai iya ba.
Yin hayar sabar yana canza wanda kake amincewa da shi, kuma baya kawar da tambaya. Ramin yana ɓoye zirga-zirgar ka daga cibiyoyin sadarwar da yake bi, sannan yana ba da rubutun bayyananne ga na'urar da hypervisor na wani yake tafiyar da ita. Bin fakiti zuwa waje daga abokin cinikinka yana nuna inda kowane mai lura yake tsaye da abin da kowannensu zai iya gani da gaske. Wannan tafiya tana da amfani fiye da duk wata ikirarin kasancewa ba a san sunanka ba.
Fara daga abokin ciniki ka bi fakiti zuwa waje
Kafin wani abu ya bar kwamfutar tafi-da-gidanka, abokin ciniki yana naɗe fitin ɗin kuma yana aika shi zuwa gaɓar jama'a ta sabar. Cibiyar sadarwar gida da mai ba ka intanet suna ganin kwarara ɗaya zuwa wannan adireshi da tashar, da girma da kuma ƙari. Abin da ba su gani ba shi ne wane shafi ka buɗe, domin wannan makoma tana cikin kayan da aka ɓoye. Layin tsakanin bayanan meta da abun ciki shi ne dukan tafiyar a jumla ɗaya.
Wannan tsalle ta farko ita ce inda yawancin ikirarin talla suka daina zama masu ban sha'awa. Maƙwabci a kan Wi-Fi ɗaya yana ganin abin da mai intanet yake gani, kuma babu ɗayansu da yake ganin shafin. Amma girman da lokaci suna nan a bayyane, kuma suna bayyana ɗabi'a ko da kayan ba ya yin haka.
Cibiyar sadarwar hosting tana ganin rami, ba shafin ba
A cikin cibiyar sadarwar mai bayarwa kwararar da aka ɓoye tana isa wurin maɓalli, sannan zuwa gaɓar kama-da-wane, sannan zuwa VM ɗinka. Duk wanda yake tafiyar da wannan cibiyar zai iya kirga baiti da adana bayanan kwarara ba tare da riƙe wani maɓalli ba, kuma ba a buƙatar maɓalli don haka. Wannan shi ne ainihin matsayin da mai ba da hosting yake ɗauka.
A hanyar fita hoton yana canzawa. VM yana buɗe sabuwar haɗi zuwa makoma, don haka cibiyar sadarwar hosting tana iya ganin wannan adireshin makoma da musafaha na TLS da ke kewaye da shi. Kayan yana nan yana da kariya ta ɓoyewar aikace-aikacen da kansa, amma bayanan meta ba.
| Observer | Visible to it | Hidden from it |
|---|---|---|
| Local network | Tunnel endpoint, volume, timing | Destination and payload |
| Your ISP | The same flow metadata | Destination and payload |
| Hosting network | Tunnel flow, exit destination, TLS handshake | HTTPS payload |
| Hypervisor operator | Guest memory and virtual NIC, in principle | Nothing, if it chooses to look |
Karanta layukan a jere sai siffar matsalar ta bayyana: kowanne yana gani fiye da layin da ke sama da shi, kuma babu wanda zai buƙaci karya VPN don yin haka.
A cikin VM ramin yana ƙarewa kuma rubutu bayyananne yana farawa
Ramin yana ƙarewa a VM ɗinka, don haka baƙon yana ganin fitin na ciki kafin wani abu ya sake ɓoye shi. Wannan ba aibi ba ne; abin da fitowar da ka yi hosting da kanka take yi ke nan. Yana nufin tsaron fitowar ya dogara da wanda yake kula da baƙon, kuma a wannan lissafin kai ne mai kula.
wg show
ss -tunp | head
nft list ruleset | head -40Gudanar da waɗannan a kan sabar kuma kana duba soket ɗin da mai aiki mai root a kan baƙo zai iya dubawa. Duk abin da ayyukan da kake gudanarwa suka yi log ɗinsa yana cikin wannan iyakar amana, shi ya sa saitunan log ɗin baƙo da bayanan kayan more rayuwa tambayoyi biyu ne daban maimakon saiti ɗaya.
Hypervisor yana zama a ƙasan baƙo
Na'urar kama-da-wane ba ta mallaki kernel ɗin da take gudana a kai ba. Hypervisor yana tsara ƙwaƙwalwar ta da katin sadarwar kama-da-wane, don haka mai aiki a wannan matakin yana wajen iyawar baƙon ya duba shi. Keɓewar baƙo ta gaske ce kuma ta cancanci amincewa tsakanin masu haya, kuma ba alkawari ba ne cewa samun dama ta musamman ba zai yiwu ba. Wannan rashin daidaito ya cancanci a faɗe shi a fili maimakon a ɓoye shi a bayan kalmar keɓewa.
Sabar jiki da aka keɓe tana canza tsarin ba tare da cire cibiyar sadarwa, samun damar jiki ko hanyar gudanarwa da mai bayarwa yake bayarwa ba. Karanta abin da kayan suka rubuta maimakon barin kalma ɗaya ta yanke tambayar samun dama.
Maida wannan tafiya shawarar amana
Rubuta kowane mai lura da ikon da kake ba shi, sannan ka yanke shawara ko wannan bayarwa ta dace da zirga-zirgar da kake shirin aikawa. Jerin gajere ne: cibiyar sadarwar gidanka, mai ba ka intanet, cibiyar sadarwar hosting, mai aiki da hypervisor, da kai. Duk wani abu kuma ɗan kwangila ne na ɗaya daga cikinsu kuma yana gado irin wannan ikon. Yanke shawara tun da wuri ya fi araha fiye da gano jerin daga baya.
Sannan tabbatar da sassan da za ka iya tantancewa da gaske: waɗanne log ɗin ayyukanka suke rubutawa, tsawon lokacin da kake ajiye su, da abin da mai bayarwa yake wallafawa game da bayanan kwarara da riƙewa. Manufofin da za ka iya karantawa da gwadawa sun fi zato game da abin da kalma kamar sirri take nufi.